jakman85andClaude Opus 4.8
e99e3d1666
Adding the SSH key pushed the inline cloudInitNoCloud.userData over KubeVirt's
2048-byte limit ("userdata exceeds 2048 byte limit. Should use UserDataSecretRef").
Move the cloud-init into apps/vms/unifi/unifi-cloudinit.yaml and wrap it as the
`unifi-cloudinit` Secret via a Kustomize secretGenerator (disableNameSuffixHash
so the VM can reference it by fixed name); VM now uses userDataSecretRef. Content
is non-sensitive (public key + public installer script), so not SOPS-encrypted.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
60 lines
3.6 KiB
YAML
60 lines
3.6 KiB
YAML
#cloud-config
|
|
# UniFi OS Server VM cloud-init. Wrapped into a Secret (userDataSecretRef) by the kustomization's
|
|
# secretGenerator because it exceeds KubeVirt's 2048-byte inline cloudInitNoCloud.userData limit.
|
|
# NON-SENSITIVE (a public SSH key + a public installer script), so it is NOT SOPS-encrypted.
|
|
#
|
|
# install-uos resolves the LATEST UniFi OS Server linux-x64 installer from Ubiquiti's PUBLIC firmware
|
|
# API (fw-update.ui.com/api/firmware-latest, no auth) — no per-release URL to bump (override with
|
|
# UOS_URL=<href>). cloud-init installs the prerequisites, downloads the installer (~840MB) and runs it
|
|
# NON-INTERACTIVELY (`yes |`). The UI comes up on https://<vip>:11443 once installed.
|
|
hostname: unifi
|
|
fqdn: unifi.home.keithjackson.dev
|
|
# Break-glass OS access on the default `ubuntu` user (public key — safe to commit) for ops/debugging.
|
|
# qemu-guest-agent (below) additionally enables `virtctl` guest access.
|
|
ssh_pwauth: false
|
|
ssh_authorized_keys:
|
|
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCq3JM7CD3P+OExaD4sQARLDQUf5QqDRemAO0qWA3fG7O/6ncgX0d/xN95lJ5Ei8LewlzXF5cCVe43oJ5CJRjh41igWZ38XXgOQcbAbY0lZTJlJg/SAj9Xni++JY3Jws5Nslm8qCrqt1bDsP3O3Lnp4hmBVZ+1eJy3v9HlJ2/1mVOukIob/zVXQNdOpVx1+oubNqo+UYt3l1IxqF8x+2JlHt+POaTBMqbC3JDCaStkkHN20xItpydHZ2uSamXaTx2MH+rQjrABjuD6Xxbhxhx0hG2XrVDWyAuq91aZUpuDkybcuHnpQUSHeZJCMqDCd3Q8yd/dyifDZE8QcnY5hiVHJF8VzJT/r5+em+I4LESlE5WNfq80TWG42d9gw7Yi/8xT38iDm+0nArMd/laAPpH0JGvdIyMdWcVZgfWTgcT6EZ9cIK2J4N+ijrh/V+xwzApmYyMdVsu2UjMeKrJG4VZk43XKnpfJCLJ2LmwtPMKqrI+wyge9Bav2+t+taznKP141gL6YJW3gwArzj+oktK+/fbahtBAUnjh5emLb2rv0gbAHC9cNbovEIdA3A6FDME96zAlozU4AtoCTA7SA1AqIHuAOHkqGYFBV77eriO85K0J1qo0FwuByFINI6G/JtEnNa+CjJLvh0clJonw+6+iR2vB1hwfDmLLwrE7QRT7Ho9w== [email protected]
|
|
package_update: true
|
|
package_upgrade: false
|
|
packages:
|
|
- qemu-guest-agent
|
|
- podman
|
|
- uidmap
|
|
- slirp4netns
|
|
- ca-certificates
|
|
- curl
|
|
- jq
|
|
- cloud-guest-utils
|
|
write_files:
|
|
# Install (or reinstall) UniFi OS Server. URL is public/no-auth; override at runtime with:
|
|
# sudo UOS_URL='https://fw-download.ubnt.com/...' install-uos
|
|
- path: /usr/local/sbin/install-uos
|
|
permissions: '0755'
|
|
content: |
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
# Resolve the latest UOS linux-x64 installer from Ubiquiti's public firmware API (no auth).
|
|
# Override by exporting UOS_URL=<href> to pin a specific build.
|
|
if [ -z "${UOS_URL:-}" ]; then
|
|
UOS_URL="$(curl -fsSL https://fw-update.ui.com/api/firmware-latest | jq -r '
|
|
._embedded.firmware
|
|
| map(select(.product == "unifi-os-server" and .platform == "linux-x64"))
|
|
| sort_by(.version_major, .version_minor, .version_patch)
|
|
| last._links.data.href')"
|
|
fi
|
|
[ -n "${UOS_URL}" ] && [ "${UOS_URL}" != "null" ] || { echo "could not resolve UOS installer URL"; exit 1; }
|
|
tmp="$(mktemp /tmp/uos-installer.XXXXXX)"
|
|
echo "Downloading UOS installer: ${UOS_URL}"
|
|
curl -fL --retry 5 --retry-delay 10 -o "$tmp" "$UOS_URL"
|
|
chmod +x "$tmp"
|
|
echo "Running UOS installer non-interactively"
|
|
yes | "$tmp"
|
|
echo "UOS install finished; 'uosserver status' should report running (UI :11443)"
|
|
runcmd:
|
|
- [ systemctl, enable, --now, qemu-guest-agent ]
|
|
- [ systemctl, enable, --now, podman.socket ]
|
|
# Full unattended install; tee to the serial console AND /var/log/uos-install.log for visibility.
|
|
# Non-fatal so a failed install leaves the VM up for `sudo install-uos`.
|
|
- [ 'bash', '-lc', '/usr/local/sbin/install-uos 2>&1 | tee /var/log/uos-install.log | tee /dev/console; echo "install-uos exit=${PIPESTATUS[0]}" | tee -a /var/log/uos-install.log > /dev/console' ]
|
|
final_message: "cloud-init finished; UOS install log at /var/log/uos-install.log (UI :11443)"
|